f993f8641ae9862b48d2fadcc73fcad5e4e54571ac65282e49d69df43e0c69c3

Analysis

Target
emotet_exe_e4_f993f8641ae9862b48d2fadcc73fcad5e4e54571ac65282e49d69df43e0c69c3_2022-03-07__171034.dll
Size 383KB
Sample220307-vp83dafef9
SHA256 f993f8641ae9862b48d2fadcc73fcad5e4e54571ac65282e49d69df43e0c69c3
MD5 03ebef0f01c6991c6573015e46365dea
SHA1 20833e664af02fc591dc7d01300eccbabfb133ab
SHA512 3e26e2070c0141561d03ea57d18a757118e6370746a69de97e002c64438f0044bf1d1e6cea46be78b042998f7a9742348864642bd474df1d59f7d34f1236f273
MD5 SHA1 SHA512

Score

1^/10

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1080	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1080	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1080	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1080	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1080	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1080	1664	regsvr32.exe	27
PID 1664 wrote to memory of 1080	1664	regsvr32.exe	27

C:\Windows\system32\regsvr32.exe
regsvr32 /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f993f8641ae9862b48d2fadcc73fcad5e4e54571ac65282e49d69df43e0c69c3_2022-03-07__171034.dll
1⤵
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Windows\SysWOW64\regsvr32.exe
  /s C:\Users\Admin\AppData\Local\Temp\emotet_exe_e4_f993f8641ae9862b48d2fadcc73fcad5e4e54571ac65282e49d69df43e0c69c3_2022-03-07__171034.dll
  2⤵
  PID:1080

memory/1080-55-0x0000000075801000-0x0000000075803000-memory.dmp

Download

memory/1664-54-0x000007FEFC381000-0x000007FEFC383000-memory.dmp

Download